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Issue # 1: 

The Examiner has rejected Claims 1-7, 9-10, 12-20, 22-23, 25-28, and 30 under 35 U.S.C. 
103(a) as being unpatentable over "Q222193- Description of the Windows 2000 Windows File 
Protection Feature" (hereinafter WFP), in view of Rickey et al. (U.S. Publication No. 
2002/0166059). 

Group #7: Claims 1-2, 4-7, 13-15, 17-20. and 26-27 

With respect to the current grouping, and specifically appellant's claimed technique "wherein the 
factors are altered based on the monitoring of the requests to write to the files on fee computer," 
the Examiner has responded to appellant's arguments, in the Office Action mailed 1/12/06, by 
stating that "when WFP is monitoring for modifications to files the write request is part of the 
change and therefore part of the monitoring." First, appellant respectfully asserts that what is 
claimed is "factors rthafl are altered based on the monitoring of the requests" (emphasis added), 
and not merely monitoring write requests, as the Examiner argued. Appellant emphasizes that 
WFP teaches that the "Windows File Protection feature is implemented when it is notified that a 
file in a protected folder is modified" and that a "second protection mechanism [is] . . .the System 
File Checker tool [that] scans all protected files to ensure they are not modified." Thus, WFP 
only discloses a situation where it is determined if a file has already been modified, and not 
altering factors "based on the monitoring of the requests " (emphasis added), as claimed by 
appellant. Furthermore, WFP discloses restoring a file to a correct Microsoft version, but not 
altering factors associated with the computer, in the manner claimed by appellant. 

In the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "[ajs described on 
page 4 of appellant's specification, 'the factors are selected from the group consisting of critical 
files, critical file locations, and trusted applications'" and that therefore "the critical files of WFP 
are the claimed factors." Further, the Examiner has argued that "since files are factors, as 
disclosed in appellant's specification, changing a modified file to a correct version is altering that 
factor." However, appellant respectfully points out that what is claimed is a technique "wherein 
the factors are altered based on the monitoring of the requests to write to the files on the 
computer" and the factors may include, but are not necessarily limited to "the group consisting of 
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critical files, critical file locations, and trusted applications," as the Examiner's contends. Thus, 
despite the Examiner's arguments, WFP clearly fails to meet appellant's claimed "factors fthatl 
are altered based on the monitoring of the requests " (emphasis added), as claimed. 

Further, in the Examine* '$ Answer mailed 08/23/2006, the Examiner has argued that "WFP 
monitors a file system to determine when a file has been modified, and whenever a file is 
modified a write occurs in the system and with every write call exists a write request, therefore, 
WFP monitors write requests." Appellant respectfully disagrees with the Examiner's argument 
and asserts that the mere disclosure of notification when a file has been modified simply fails to 
even suggest that WFP monitors Requests to write to the files," as claimed by appellant. 
Specifically, WFP discloses that "it is notified that a file in a protected folder is modified" 
(bottom of Page 1 - emphasis added). However, the mere disclosure by WFP of being notified 
when a file is modified simply fails to even suggest that "factors are altered based on the 
monitoring of the requests to write to the files on the computer" (emphasis added), as claimed by 
appellant. Clearly, WFP's notification when a file is modified fails to meet appellant's claimed 
''monitoring of the requests to write to the files," in the manner as claimed by appellant. 

Second, appellant respectfully disagrees with the Examiner's argument that "each time a file [is] 
written (i.e. modified) a write request occurs" such that "the write request [which is] part of the 
change.. . [is] therefore part of the monitoring/' as noted in the Office Action mailed 1/12/06. 
Specifically, WFP only teaches that the "Windows File Protection feature is implemented when 
it is notified that a file in a protected folder is modified " and that "[o]nce the notification is 
received, the Windows File Protection feature determines which file was changed " (emphasis 
added). Thus, in WFP, the monitoring is performed with respect to when an actual modification 
has already been made, and not to when a request to write to the files on the computer is made, in 
the manner claimed by appellant. To emphasize, appellant claims altering factors based on a 
request and not merely a file modification that has already been made, as in WFP. As such, 
appellant's claim language allows for the M writes to the files on the computer" to be prevented 
such that the modification is not made, in the manner claimed. 

In the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "when a 
modification to a file protected by WFP is made that places it in an incorrect version, it is 
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replaced with the correct version" and that "[tjhis replacement is based on the determination that 
the file is an incorrect version, thereby preventing the incorrect version from being written." 
Appellant respectfully disagrees with the Examiner's argument, and asserts that WFP instead 
merely discloses that "it is notified that a file in a protected folder is modified " and mat "if the 
file is protected, the Windows File Protection feature looks up the file signature in a catalog to 
determine if the new file is the correct Microsoft version" (bottom of Page 1 - emphasis added). 
Appellant asserts that WFP's disclosure that the file is modified resulting in a new file which 
causes WFP to look up the file signature in a catalog to determine if it is the correct Microsoft 
version, contradicts the Examiner's argument that the WFP's "replacement . . . prevents] the 
incorrect version from being written." Again, appellant's claim language allows for the "writes 
to the files on the computer" to be prevented, as claimed, such that the modification to the file is 
not made. Clearly, WFP's disclosure of replacing the new file after it is modified rails to suggest 
preventing "writes to the files on the computer," in the manner as claimed by appellant. 

Further, appellant respectfully asserts that if WFP prevented writes to the file, as asserted by the 
Examiner, then the file would not need to be replaced since the file would be prevented from 
being modified to the incorrect version. Clearly, since WFP discloses that a modified file of an 
incorrect version is replaced with the correct version, WFP fails to meet appellant's claimed 
preventing "writes to the files on the computer," as claimed, and even teaches away, 
Still with respect to the present grouping, and specifically appellant's claimed technique 
"wherein the factors are updated based on the requests," the Examiner has responded to 
appellant's arguments, as noted in the Office Action mailed 1/12/06, by stating that in WFP 
"when a file is changed to an incorrect version, WFP replaces the file with the correct version, 
which is both altering and updating." Appellant respectfully asserts that WFP only teaches 
responding to the actual modifications of files, and not to "update[ing] based on the requests " 
(emphasis added), as claimed by appellant. 

In the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "[a]gain, the file is 
the factor and when fee incorrect version of a file is detected it is replaced with the correct 
version based on the detection, i.e. the file is updated to the correct version" and that "monitoring 
for modifications corresponds to monitoring write requests as discussed above." Appellant 
respectfully disagrees with the Examiner's arguments, and respectfully asserts that, in WFP, the 
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file is updated after being modified. Thus, the update is based on the modification, which clearly 
does not meet appellant's claimed "factors [that] are updated based on the requests " (emphasis 
added), as claimed by appellant, where the requests are "requests to write to the files on the 
computer," in the context as claimed by appellant. 

To establish a prima facie case of obviousness, three basic criteria must be met. First, there must 
be some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the ait, to modify the reference or to combine 
reference teachings. Second, there must be a reasonable expectation of success. Finally, the 
prior art reference (or references when combined) must teach or suggest all the claim limitations. 
The teaching or suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on applicant's disclosure. In re 
Vaeck.9AH E2d 488, 20 USPQ2d 1438 (Fed.Cir.1991). 

Appellant respectfully asserts that at least the first and third elements of the prima facie case of 
obviousness have not been met, for the reasons noted above. 

Group #2: Claim 28 

With respect to the present grouping, the Examiner has relied Upon pages 1-2 in WFP to make a 
prior art showing of appellant's claimed technique "wherein the at least one of critical files and 
critical file locations are looked up based on requests to write to the at least one of critical files 
and critical file locations on the computer." 

Appellant respectfully asserts that pages 1-2 from WFP merely teach "cache[ing] all protected 
systetn files" in order to replace any modified protected files. However, restoring protected 
system files from a cache or installation media after they are modified clearly fails to even 
suggest a technique therein the at least one of critical files and critical file locations are looked 
up based on requests to write to the at least one of critical files and critical file locations on the 
computer" (emphasis added), as claimed by appellant. 
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Ift the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "WFP disclose[s] 
that when a file is modified to an incorrect version, the correct version of that file is looked up 
and teplaced with the correct version of the file from a cache as shown on the bottom of page 1 
to the top of page 2 and is therefore looked up based on the request to write," Appellant 
lespectfully disagrees with the Examiner's argument and respectfully asserts that WFP merely 
teaches that the "Windows File Protection feature is implemented when it is notified that a file in 
a protected folder is modified" and that fi '[o]nce the notification is received, the Windows File 
Protection feature determines which file was changed " (emphasis added). Further, WFP teaches 
that "Windows File Protection feature looks up the file signature in a catalog to determine if the 
new file is the correct Microsoft version" and "Jj]f it is not, the file is replaced from the Dllcache 
folded (emphasis addedV However. WFP's HisrH n«mrf>nf hointr 




